Visualization, Reporting, and Decision Making with TIPs TIE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security team wants to measure whether the TIP's reports are being used by the incident response team. Which KPI is most appropriate?

   • ANumber of reports generated by the TIP
   • BTime spent on TIP training
   • CPercentage of incidents where TIP reports were referenced in the incident ticket
   • DNumber of analysts with TIP access
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A threat intelligence team has identified a vulnerability in a third-party application used by the organization. The team must decide whether to apply an emergency patch that could disrupt business operations or wait for the next scheduled maintenance window. Which decision-making framework would best help the team weigh the risk of exploitation against the operational impact?

   • AA decision based on the vendor's advisory severity rating alone
   • BA cost-benefit analysis that only considers the cost of the patch
   • CA risk assessment that scores the likelihood of exploitation and the impact on business operations
   • DA decision to always defer patching to avoid disruption
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A threat hunting team wants to use TIP visualizations to identify patterns of lateral movement across the network. Which TIP visualization capability is most directly useful for this task?

   • AA bar chart of alerts by severity
   • BA timeline of threat actor activity
   • CA pie chart of malware family distribution
   • DA link analysis graph showing connections between hosts, users, and processes
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   An analyst receives multiple threat intelligence reports about different active campaigns. Which decision-making framework is most appropriate to determine which campaign poses the greatest immediate threat to the organization?

   • AFive Whys
   • BPrioritization matrix
   • CPESTLE analysis
   • DGap analysis
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security manager wants to prove the value of the TIP to leadership. They have data on the number of reports produced, the number of IOCs consumed by the SOC, and the average time to detect and respond to incidents. Which metric would best demonstrate the TIP's impact on security outcomes?

   • ANumber of reports produced per month
   • BReduction in mean time to detect (MTTD) and mean time to respond (MTTR)
   • CNumber of IOCs consumed by the SOC
   • DNumber of analysts trained on the TIP
   Reveal Solution Discussion Select an answer first